Summary
We don't log the websites you visit, your DNS requests or the content of your traffic.
To run the service we keep basic records: your account, your devices and when they connect to which server.
The free version shows ads from Google AdMob. Premium has no ads.
Payments go through Apple or Google. We never see your card.
You can delete your account at any time; your personal data is erased 30 days later.
This policy explains what CosmoVPN ("we") collects when you use the CosmoVPN apps and this website (https://cosmovpn.io), why, and what you can do about it.
What we never collect
- The websites you visit and the apps you use through the VPN.
- Your DNS requests.
- The content of your traffic.
We don't sell your personal data.
What we collect
Your account
If you create an account: your e-mail address, your password (stored only as a one-way hash, never in readable form), when the account was created and when the password was last changed. You can use CosmoVPN without an account, as a guest.
Your devices
For each device logged in to your account: an identifier of the device (read from its operating system), the platform (for example Android or Windows) and when it logged in. This is how we limit the number of devices per account and how you can sign devices out.
Connections
When you connect, we record the time, how long the connection may last, the server (country and city), your device identifier and model, the app version, whether you were logged in and which connection mode was used. We need this to give you a place on a server and your connection keys, to keep limits working and to stop abuse, and we use it for overall numbers such as the total number of connections. These records don't contain the websites you visit.
Premium subscriptions
When you buy Premium, Apple or Google tell us which plan you bought, its status, its dates, whether it renews and the transaction or order identifiers, so we can give Premium to your account. We don't receive your name, address or card details.
Support
If you chat with our team in the app, we keep the messages and pictures you send so we can help you.
Password reset
If you forget your password, we e-mail you a one-time code. It is stored until it is used or expires 15 minutes later.
Your country
To show where you are on the map and choose good settings for your region, the app looks up your country from your IP address with a public IP-to-country service. We don't store the result.
IP address check on this website
The What is my IP page and the connection check on the home page send your IP address to our API, which looks it up in the DB-IP location database on our server and sends back its approximate location and internet provider, and whether it belongs to one of our servers. The same happens for addresses you look up there. We don't save the checks or their results, and they aren't written to our API's request log; to prevent abuse, our server counts the checks from each address in memory for up to a day.
Technical logs
Like most online services, our servers may briefly log requests to our API, including IP addresses, to protect the service and fix problems.
Ads in the free version
The free version of the app shows ads from Google AdMob. To show and measure ads, Google may collect information about your device, such as the advertising identifier, under Google's advertising policies. On iPhone and iPad the app asks for your permission before it may track you (App Tracking Transparency), and you can say no. You can also reset or limit the advertising identifier in your device settings. Premium has no ads.
This website
- No ads, analytics or tracking cookies.
- Fonts and icons are served from our own site.
- When you log in, a login token is kept in your browser's local storage for up to 30 days. It is removed when you log out. Changing your password ends the sessions in your other browsers.
- The pages load public numbers from our API, such as our server locations and statistics.
How we use data
- To provide the VPN: accounts, devices, connections and Premium.
- To keep the service safe: limits, fraud and abuse prevention.
- To answer your support messages and send password reset codes.
- To understand how the service is used, in overall numbers.
How long we keep it
We keep your account data while you have an account. When you delete your account, you are signed out on every device at once. We keep the locked account for 30 days in case it was deleted by mistake; then your e-mail address, password, devices and support chat (messages and pictures) are erased. Records of payments and subscriptions are kept for accounting, and connection records stay; after the erasure neither is linked to your e-mail address any more.
Your choices and rights
- See your plan and devices, and sign devices out, in My account.
- Change your password, or delete your account on the Delete account page.
- Ask us for a copy of your data, or to correct or delete it: e-mail [email protected].
- Manage or cancel subscriptions in the App Store or on Google Play.
Depending on where you live, you may have further rights under local law; contact us and we will help.
Security
The VPN connection is encrypted with WireGuard and our website and API use HTTPS. Passwords are stored as one-way hashes, and access to our systems is limited. No system is perfectly secure, but we work to protect your data.
Children
CosmoVPN is not directed at children under 13, and we don't knowingly collect their data. If you think a child gave us personal data, contact us and we will delete it.
Changes to this policy
When we change this policy we update it on this page and change the date at the top.
Contact
Questions about privacy? E-mail [email protected].